News for hackers. Stuff that matters.

A comment on LastPass Security Notice. Parent comment

Re:LastPass Security Notice by _pcdx on Tuesday June 16, 2015 @07:24AM (#9725015)
Sorry, should have mentioned a bit about that. The Password Safe format is public, open, and available here [1]. There's also plenty of code/libraries you can use to write your own clients, e.g. Javascript [2], Java [3], Python [4]. For what it's worth the core data encryption is done using the Twofish cipher. Hope that helps.

[1]: http://sourceforge.net/p/passwordsafe/git-code/ci/master/tre...

[2]: https://github.com/scintill/pwsafejs

[3]: http://sourceforge.net/projects/jpwsafe/

[4]: https://github.com/ronys/pypwsafe

[ Parent | on HN ]
Re:LastPass Security Notice by pckspcks on Wednesday June 17, 2015 @05:19AM (#9730733)
That both does and doesn't help. There is the format, which looks sensible. There are the protocols around it, key generation, salt generation, overall design, etc. which are not.

What actually scares me about the design is if my machine is compromised, an attacker can grab my Password Safe file (plus keylogs or whatever) and has access to all of my passwords. The design seems not very robust at a designs+protocols level.

(In contrast, right now, if a machine is compromised, it only compromises the passwords I've used from that machine).

[ Parent | on HN ]